Application deployment and Security Flashcards
Name the 4 tier structure for app deployment
Development
Testing
Staging
Production
Development models (types of servers)? (4)
Bare Metal
Virtual Machine
Container Based
Serverless
Difference between type 1 and type 2 hypervisor
Type 1 - Bare metal
Type 2 - runs as an application on a OS
Types of infrastructure? (5)
On-premise Private Cloud Public Cloud Hybrid Cloud Edge Cloud
What is docker?
Container based solution to contain an application, without worrying about underlying OS libraries etc.
Dockerfile - to pull from and existing image (first line of docker file)?
FROM
Dockerfile - set the working directory
WORKDIR
Dockerfile - copy files
COPY
Dockerfile - execute commands when docker starts
CMD
Dockerfile - execute commands as part of the build
RUN
Command to build docker image
docker build -t .
Start a docker image
docker run image_name
docker run -P vs -p
- p 8080:80 will translate local port 8080 to docker port 80
- P will use the dockerfile EXPOSE ports to local random ports
docker run but detach option
docker run -d image_name
docker - enter an running container
docker exec -it container_name /bin/sh
download a docker image
docker pull NAME:TAG
upload a docker image
docker push NAME:TAG
list running docker images
docker ps
docker container ls
In CI/CD explain what CI is
Its the process of continually merging small changes to the code so that any given change set is small with less impact than a big change
In CI/CD whats the difference between Continuous Delivery vs Continuous Deployment
Delivery - ensures shorts sprints are always done to ensure code is deployable
Deployment - code is constantly deployed provided its tagged ready for production (tests are done in Delivery)
Name methods to avoid impact to users when deploying new code or changes to code (3)
Rolling upgrade:
Canary Pipeline:
Blue/Green deployment
CI/CD Benefits (6)
Integration with agile methods Shorter MTTR Automated deployment Less disruptive Improved quality Improved time to market
Load balance methods (6)
Persistent Round Robin Least Connections IP Hash Blue-Green Canary
Three common web attacks
SQL injection
Cross-Site Scripting (XSS)
CSRF
Whats the difference between data at rest and data in flight
Data at rest - when data is being stored
Data in flight or in motion - when data is being transferred
Things to consider when storing data (5)
Encrypting data: One way/Two way encryption
Software vulnerabilities: be mindfull when using existing libraries
Storing too much data: store what you need
Storing data in the cloud: data is stored on someone else hardware
Roaming devices: laptops, phones etc
Explain one way vs two way encryption
One-way encryption: doesn’t need a key and doesn’t need to be decrypted once encrypted
Two-way encryption: Uses a key to encrypt and store then decrypt when you need it again
Best practice for transporting data
SSH
TLS
VPN
OWASP
Open Web Application Security Project
Defines tools and documentation to avoid common web security issues
Top 10 OWASP list
- Injection
- Broken authentication
- Sensitive Data Exposure
- XML External Entities (XXE)
- Broken Access control
- Security Misconfiguration
- Cross-Site Scripting (XSS) -
- Insecure Deserialization
- Using components with known vulnerabilities -
- Insufficient logging and monitoring
What is a salted password
Using random data to hash the password, ie the same password will have different hash.
Password cracking methods
Password guessing
Dictionary attack
Rainbow table - using pre-compiled list of password hashes
Social engineering
Types of attacks to gain information
- Phishing - fraudulently gaining information through links etc.
- Vishing (Voice Phishing) - voice calls to gain info
- Smishing - Phishing via sms
- Impersonation - impersonating someone of authority or service provider
6 principles of human influence
○ Reciprocity - return a favour when asked
○ Commitment and consistency - when people commit they tend to honour it… ie sign up later checkbox.
○ Social Proof - follow the sheep mentality
○ Authority - People obey authority figures
○ Liking - like-able people can persuade people easily
○ Scarcity - when items or offers or limited, offers are taken up quickly
What is ISC
Information Security Culture
The behavior of employees that has an impact on organizations data
DevOps Principals (7)
Iterative - break process into smaller bits
Incremental - Projects need to be developed in small and rapid incremental cycles
Continuous - merge development and deployment into simpler process
Automated - everything can be automated
Self-service - What DevOps principle Every IT engineer should have the same development environment to develop and test projects
Collaborative - teams need to work together
Holistic - Treats process as a whole service
Types of SQL injection
In-band SQL injection
Inferential or blind SQL injection
Out-of-band SQL injection
